topic Re: Pivot Boolean Lables in Reporting

Pivot Boolean Lables

ltawfall — Fri, 11 Oct 2013 23:53:34 GMT

I'm working with splunk6, data models and pivot tables. When I use the GUI function to relabel "True" and "False" to something more meaningful it doesn't actually display the labels.

Has anyone gotten the labels to actually show up in a pivot?

Re: Pivot Boolean Lables

Simon_Fishel — Mon, 14 Oct 2013 23:55:18 GMT

They work for me. Can you describe how you set up the field in your data model? And exactly what you're trying to do in pivot?

Re: Pivot Boolean Lables

ltawfall — Mon, 14 Oct 2013 23:59:46 GMT

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

in the table, I split the column "is_anonymous" and relabeled "true == anonymous" and "false == authenticated" but the table still shows true/false as the table column headers, rather than using the labels.

-l

Re: Pivot Boolean Lables

ltawfall — Mon, 14 Oct 2013 23:59:58 GMT

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

-l

Re: Pivot Boolean Lables

Simon_Fishel — Tue, 15 Oct 2013 14:46:08 GMT

And how are you extracting the boolean attribute? I think it has to have a value of either the string "true" or the string "false". In my case I'm using an Eval and the expression looks like this:

if(sourcetype == "foo", "true", "false")